A Website Backup Strategy: The 3-2-1 Rule and Restore Testing

Backup is a task most businesses tick off as “done” but rarely test. Yet in a real incident the question will not be “do you have a backup?” but “can your backup be restored, and how fast?”

The 3-2-1 rule

• 3 copies: live data + at least two backup copies
• 2 different media: for example server disk and object storage
• 1 remote copy: in a different data centre, or offline/immutable

These days a “0 errors” is added: the backup is verified.

What to back up

Not just files; the database, configuration files (nginx, php.ini, .env), e-mail and DNS records should be included. For WordPress, take the wp-content folder and database separately and note plugin and theme versions.

Frequency and retention

• Database: hourly if transaction-heavy, otherwise daily
• Files: daily incremental, weekly full
• Retention: 14–30 days daily, 12 months monthly archive (depending on regulation)

Against ransomware

Attackers go for backups first. Storing backups immutably in an account that the source server cannot reach is the most effective defence against ransomware.

Restore testing

Every three months restore a backup to a test environment and measure the time. That shows your RTO (recovery time objective). Verify database consistency and that the application starts.

How it works at Ovabit

On hosting plans a daily backup is kept for 14 days and restored in one click from the panel. On cloud servers the backup add-on plus replication to a second site applies the 3-2-1 rule automatically.

Backup checklist

• Are the database, files, configuration and e-mail included?
• Is at least one copy in a different data centre?
• Are backups encrypted? Is the encryption key stored separately?
• Do you receive an e-mail/SMS alert when a backup fails?
• Are restore steps written down and known by at least two people?
• When was the last restore test and how long did it take?

Reviewing this list twice a year and recording the results is the greatest assurance for both audits and real incidents. Every item you find missing should become an improvement task.